BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 07-17-2009, 09:18 AM   #1 (permalink)
Knows Where the Search Button Is
 
Join Date: Apr 2009
Model: bold
PIN: N/A
Carrier: Vodacom
Posts: 25
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Blackberry Server and the DMZ!!!

Please Login to Remove!

Hi

We have a Blackberry Server that sends the mail out via our Proxy Server. Our Security team wants to move that to the DMZ Part of our network. What needs to be done for Blackberry to still work. I check some stuff on the web and they talk about a blackberry router that you can put in the dmz, but we dont have one.

Hope i gave enough information.

Thanks
Offline  
Old 07-17-2009, 10:42 AM   #2 (permalink)
BlackBerryForums.com Super Moderator
 
SteveO86's Avatar
 
Join Date: Sep 2007
Location: Florida
Model: 9650
OS: 6.0.0.280
PIN: I heard it drop!
Carrier: VZW BIS
Posts: 6,534
Post Thanks: 0
Thanked 4 Times in 1 Post
Default

BlackBerry Router is a Service on the BES, that can be installed on a separate box, inside the DMZ.

I would check the BES documentation for your particular version.
__________________
8830 -> 8330 -> 9550 -> 9650
Just think about how far BlackBerries have come from then till now... And what else is coming.

Follow me on Twitter
Offline  
Old 07-17-2009, 01:24 PM   #3 (permalink)
BlackBerry Extraordinaire
 
CanuckBB's Avatar
 
Join Date: Feb 2006
Location: YYZ
Model: 9900
Carrier: Rogers
Posts: 1,183
Post Thanks: 0
Thanked 2 Times in 2 Posts
Default

You would need a seperate server to in the DMZ to run the BES Router service. You then need open ports for the BES to talk to it's router. That still leaves a way in. If I can get to oyur Router, I could use those open ports to get into your network.

All BES requires is port 3101 OUTBOUND to be open. It's as secure as can be.
Offline  
Old 07-20-2009, 05:09 AM   #4 (permalink)
Knows Where the Search Button Is
 
Join Date: Apr 2009
Model: bold
PIN: N/A
Carrier: Vodacom
Posts: 25
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Hi I found the following Q&A:

Q) can we have the BB server setup in DMZ. If so can someone explain me the advantages and disadvantages?

Thanks,
Sridhar

A) Yes. No point really though since you will have to poke a ton of holes in your firewall.. If you are not hosting MDS applications BES doesn't require any open incoming ports, so again no point... RIM has a lot of documentation about this.

My Q: If there are no open incomming ports, how does the blackberry sync back to the mailbox if you delete mail on the device?

Is it really necesary to have the BB Server in a DMZ??

Thanks,
Offline  
Old 07-20-2009, 10:14 PM   #5 (permalink)
BlackBerry Extraordinaire
 
Join Date: Jan 2005
Model: Many
Carrier: Sprint
Posts: 1,475
Post Thanks: 0
Thanked 6 Times in 5 Posts
Default

The BB Router can be installed in the DMZ. All other BES components need to be behind the firewall.

Quote:
Originally Posted by Frikkels View Post
Hi I found the following Q&A:

Q) can we have the BB server setup in DMZ. If so can someone explain me the advantages and disadvantages?

Thanks,
Sridhar

A) Yes. No point really though since you will have to poke a ton of holes in your firewall.. If you are not hosting MDS applications BES doesn't require any open incoming ports, so again no point... RIM has a lot of documentation about this.

My Q: If there are no open incomming ports, how does the blackberry sync back to the mailbox if you delete mail on the device?

Is it really necesary to have the BB Server in a DMZ??

Thanks,
Offline  
Old 07-21-2009, 06:42 AM   #6 (permalink)
Knows Where the Search Button Is
 
Join Date: Apr 2009
Model: bold
PIN: N/A
Carrier: Vodacom
Posts: 25
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Bb Router Install after BESX has been implented

Hi

Can you add a blackberry router to an existing BES setup. Like i said in the first reply: we have an existing BES network all working, but now they want to move it to the DMZ, i read somewhere that you can only add a BB router when you install the Server. is it possible to remove the bb router service from the existing server and move it to a machine (BTW what is the hardware specs for a bb router, i can only find the os requirements) in the dmz and make that the BB router???

Sorry i am new to the BES enviroment

Thanks,
Offline  
Old 08-12-2009, 02:21 AM   #7 (permalink)
New Member
 
Join Date: Aug 2009
Model: 8800
PIN: N/A
Carrier: TIM
Posts: 6
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default BlackBerry router in DMZ

Hi Frikkels,

as other told you before, the best thing is to install a BlackBerry router on your DMZ Network. It can be done using the setup file used to install BES Server. At the beginning, there are some installation option, which one of them is the BB Router installation.

Once installed, you don't need to uninstall the local BB Router but you have to configure the BES to forward TCP 3101 traffic to the new BB Router:
from the BES, open BlackBerry Server Configuration and, under Router settings, change the SRP address with the IP address of your BB Router. Leave the other settings (all TCP ports 3101). Obviously, the BB Router has to be configured to point the Internet SRP address (for Italy is the srp.it.blackberry.net).

We have that kind of configuration and I can confirm you that you have to open only the outgoing TCP port 3101:

BES -(TCP 3101)-> BB Router -(TCP 3101)-> Internet RIM SRP

Moreover, BB Router can run with local system account privileges so you can have a standalone machine in DMZ. Otherwise you have also to allow on the firewall all the traffic needed by a member server of an M$ AD Domain (RPC, Kerberos, LDAP and more.................).

Bye.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On





Copyright 2004-2014 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.